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Abstract _ _ _ _ _ _ _ 

This  report  presents  a  version  of  the  degraded  states  (DS)  methodology,  concentrating  on  the 
logic  used  within  fault  trees.  This  methodology  was  the  basis  for  the  system  analysis  conducted 
on  the  Bradley  Linebacker.  This  methodology  and  analysis  were  documented  within  the  System 
Analysis  Report  (SAR)  of  J.  F.  Meyers,  B.  G.  Ruth,  and  R.  W.  Kunkel  entitled, 
"Survivability/Lethality  Analysis  Report  for  the  Bradley  Linebacker,"  from  the  U.S.  Army 
Research  Laboratory,  Aberdeen  Proving  Ground,  MD  in  October  1996,  in  support  of  the  U.S. 
Army  Operational  Evaluation  Command  (OEC)  in  the  preparation  of  the  System  Evaluation 
Report  (SER).  The  Bradley  Linebacker  is  an  enhancement  to  the  Bradley  Fitting  Vehicle 
(M2A2)  with  the  ability  to  select  targets,  automatically  track  targets,  and  launch  Stinger  missiles. 
This  is  the  first  integrated  system  performed  on  any  system  where  synergy  of  different  battlefield 
threats  was  considered. 
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1.  Introduction 


1.1  Background.  The  Degraded  States  Vulnerability  Methodology  (DSVM)  is  an  analytical 
process  for  the  determination  of  (either  residual  or  lost)  capability  of  a  combat  system  following  an 
encoimter  with  a  damage  mechanism  (AbeU,  Roach,  and  Starks  1989).  The  DSVM  was  developed 
in  1988  by  the  Ballistic  Vulnerability  Lethality  Division  (BVLD)  (now  the  Ballistics  NBC  Division 
[BND])  in  conjunction  with  the  vulnerability/lethality  (V/L)  process  structure,  as  shown  in  Figure 
1.  The  V/L  process  structure  was  later  modified  by  Ruth  and  Hanes  (1996)  to  include  the  concept 
of  time  (shown  in  Figure  2).  The  degraded  states  (DS)  is  the  methodology  derived  from  using  the 
process  structure  to  carry  out  a  V/L  analysis  on  a  system. 

1.2  Objective.  This  report  presents  a  version  of  the  degraded  states  (DS)  methodology, 
concentrating  on  the  logic  used  within  the  fault  trees.  This  methodology  was  die  basis  for  the  system 
analysis  conducted  on  the  Bradley  Linebacker.  This  methodology  and  analysis  were  documented 
within  the  System  Analysis  Report  (SAR)  (Myers,  Ruth,  and  Kunkel  1996),  in  support  of  the  U.S. 
Army  Operational  Evaluation  Command  (OEC)  in  the  preparation  of  the  System  Evaluation  Report 
(SER).  The  Bradley  Linebacker  is  an  enhancement  to  the  Bradley  Fighting  Vehicle  (M2A2)  with 
the  ability  to  select  targets,  automatically  track  targets,  and  laimch  Stinger  missiles.  This  is  the  first 
integrated  system  performed  on  any  system  where  synergy  of  different  battlefield  threats  was 
considered. 

2.  Approach/Methodology 

Within  BND,  the  first  step  in  implementing  the  DSVM  lies  in  die  precise  description  of  level-3 
system-level  capabilities  within  three  simple  categories:  ability  to  move,  ability  to  operate,  and 
ability  to  communicate,  which  could  also  be  capability  categories.  In  this  particular  Bradley 
Linebacker  analysis,  the  aforementioned  categories  were  used  as  a  guide.  The  approach  for  this  case 
was  to  map  the  categories  into  tasks  identified  in  Martin  (1996).  The  results  were  as  follows. 
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VLO  (Level  0) 
Oo  1  Mapping 
VLl  (Level  1) 
Oj  2  Mapping 
VLl  (Level  2) 
©2  3  Mapping 
VL3  (Level  3) 
O3  4  Mapping 
VL4  (Level  4) 


F^urel.  The  VL  Taxonomy. 
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Figure  2.  The  Time-Discrete  Vulnerability/Lethaiity  Process  Structure. 


•  Ability  to  move 


->  ability  to  move  (mobility)  (M). 


•  Ability  to  operate - ability  to  operate  weapons  (OW), 

- ability  to  operate  Stinger  (OS). 


•  Ability  to  communicate. 

This  was  a  slight  variation  from  the  standard  approach.  As  one  will  notice,  the  ability  to 
communicate  is  not  mapped  to  any  Bradley  Linebacker  task.  In  this  particular  case,  the  ability  to 
communicate  is  defined  as  internal  verbal  exchange  between  crew  members  or  external  verbal 
exchange  between  crew  members  and  others  within  the  Bradley  Linebacker’s  military  chain  of 
command.  No  task(s)  appeared  within  the  Bradley  Linebacker’s  operational  mode  summary/mission 
profile  (OMS/MP);  therefore,  the  ability  to  communicate  was  not  mapped  into  any  of  the  Bradley 
Linebacker’s  tasks.  With  the  three  new  categories  being  considered,  and  as  applied  to  the  Bradley 
Linebacker  capabilities  analyzed  in  this  report,  each  capability  is  equivalent  to  the  task  identified  in 
the  Bradley  Linebacker  mission  profiles.  Eight  capabilities  of  interest  have  been  addressed  within 
either  M,  OW,  or  OS  categories,  as  follows. 

•  M 

-  Ml:  Ability  to  move  the  Bradley  Linebacker  (M2  CARRIER/MOVE  TASK). 

•  OW 

-  OW  1 :  Ability  to  search  for  a  target  (WEAPONS/SEARCH  TASK). 

-  OW2:  Ability  to  acquire  a  target  (WEAPONS/ ACQUIRE  TASK). 

-  OW3:  Ability  to  identify  friend  or  foe  (WEAPONS/IDEN  llbY  TASK). 
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-  0W4:  Ability  to  track  a  target  (WEAPONS/TRACK  TASK). 


•  OS 

-  OSl:  Ability  to  engage  a  target  (Stinger/ENGAGE  TASK). 

-  OS2:  Ability  to  reload/rearm  the  Stinger  missiles  (Stinger/RELOAD  REARM  TASK). 

-  OSS:  Ability  to  hit  a  target  (not  considered  within  the  OMS/MP). 

The  aforementioned  capabilities  Ml,  OWl  through  OW4,  and  OSl  through  OSS  are  listed  in 
order  of  precedence,  as  outlined  in  the  operational  mode  summary/mission  profile  (OMS/MP).  In 
other  words,  there  is  a  specific  sequence  that  must  be  followed  m  order  to  successfully  implement 
these  capabilities  within  a  mission  profile.  First,  the  platform  must  be  able  to  move  (Ml)  in  order 
to  arrive  at  its  destination.  It  also  has  to  be  able  to  fire  on  the  run.  Secondly,  target  information  is 
passed  from  an  information  gathering  source  to  the  Bradley  Linebacker.  This  allows  a  crew  member 
to  search  in  the  general  direction  for  a  potential  target  (OWl)  based  on  that  information.  Next,  the 
Linebacker  must  acquire  the  target  (OW2).  After  acquisition,  the  Linebacker  must  identify  the  target 
as  fiiend  or  foe  (OW3).  Then,  the  Linebacker  must  be  able  to  track  the  target  as  it  moves  (OW4). 
Following  OW4,  the  Linebacker  must  be  able  to  engage  the  target  (OSl).  Finally,  the  crew  within 
the  Linebacker  must  be  able  to  rearm/reload  the  Stinger  missiles  (OS2).  All  of  flieSe  activities  have 
the  potential  to  occur  while  the  Bradley  Linebacker  is  mobile  (M).  The  last  of  the  operate  Stinger 
capabilities  (OSS)  is  not  listed  in  the  Linebacker  operational  requirements  document  (ORD)  as  a 
Linebacker  capability,  although  it  is  considered  within  the  scope  of  this  integrated  V/L  analysis.  The 
reason  for  this  is  two  fold:  the  first  being  that  the  Linebacker  was  designed  with  the  intention  that 
it  would  deliva:  the  Stinger  missile.  The  Stinger  missile  is  a  fiie-and-forget  missile,  meaning  it  will 
not  receive  any  further  instructions  from  the  Linebacker  once  it  is  launched.  The  second  is  to  see 
if  the  Stinger  missile  is  susceptible  to  the  electronic  warfare  (EW)  threat  within  this  analysis. 
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The  second  step  in  the  DSVM  involves  the  construction  of  a  fault  tree  for  each  system-level 
capability.  As  utilized  within  the  O23  mapping,  a  fault  tree  is  a  methodology  to  logically  connect  all 
of  the  components  within  a  system  that  contribute  to  a  particular  system-level  operational  capability. 
These  components  are  represented  within  a  fault  tree  by  their  associated  component  states,  which 
can  be  either  damage  or  resource  flow  interraption  (RFI)  states,  depending  on  the  threat  that  interacts 
with  a  target  system.  In  general,  for  a  specific  threat,  the  component  states  within  a  fault  tree  will 
consist  of  either  physical  damage  or  RFI  states  (an  exception  to  this  rule  involves  mission-oriented 
protective  posture  [MOPP]  IV  compatibility  with  the  crew  member  components;  this  exception  will 
be  explained  later). 

2.1  Damage  States 

2J.1  Component  Damage  States.  Within  a  fault  tree,  component  damage  (CD)  states  are 
interconnected  in  either  serial  or  parallel  paths  (or  combinations  of  the  two).  CD  states  connected 
in  series  are  combined  using  the  Boolean  AND  (multiplicative)  operator,  while  CD  states  connected 
in  parallel  are  combined  using  the  Boolean  OR  (additive)  operator.  CD  states  are  evaluated  within 
the  inclusive  unit  interval  [0, 1],  where  a  state  of  1  indicates  a  fully  functional  component,  and  a  state 
of  0  indicates  a  fiilly  nonfunctional  component.  Table  1  defines  the  mathematical  operation  of  the 
Boolean  AND  and  OR  operators.  In  the  present  analysis,  all  CD  states  are  limited  to  the  binary 
values  0, 1  or  the  approximate  state  [0, 1].  An  approximate  state  is  a  state  that  is  used  to  represent 
CD  when  the  analyst  has  determined  that  some  unquantifiable  amoxmt  of  damage  has  occurred, 
whether  it  be  from  “engineering  judgment”  or  some  type  of  measurable  data.  To  obtain  the 
capability  metric  associated  with  a  fault  tree,  the  entire  tree  is  evaluated  (the  calculation  of  a  logical 
Boolean  product)  by  tracing  a  continuous  path  from  the  top  (represented  by  a  box  with  a  single 
asterisk)  to  the  bottom  (represented  by  a  box  with  a  double  asterisk)  of  the  tree.  All  components 
critical  to  the  operation  of  a  specific  capability  are  included  in  a  tree  structure;  the  loss  of  any 
component  connected  in  series  would  disrupt  the  top-to-bottom  path  through  the  tree,  whereas  those 
components  listed  in  parallel  must  all  be  killed  (State  =  0)  to  interrupt  the  path. 


*  See  the  appendix  for  more  explanation  of  Boolean  three-value  logic. 
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Table  1.  Boolean  Mathematical  Operations  Using  Binary  (0  and  1)  and  Approximate  [0, 1] 
Component  Damage  States 


1  AND  Operator  ll 

Value  of  Component 
No.  1 

Value  of  Component 
No.  2 

Net  Component  State  =  Component 
No.  1  AND  Component  No.  2 

0 

0 

0 

0 

1 

0 

1 

0 

0 

1 

1 

1 

[0, 1] 

0 

0 

0 

[0, 1] 

0 

[0,1] 

1 

[0, 1] 

1 

[0, 1] 

[0, 1] 

[0,1] 

[0, 1] 

[0, 1] 

1  OR  Operator 

Value  of  Component 
No.  1 

Value  of  Component 
No.  2 

Net  Component  =  Component 

No.  1  OR  Component  No.  2 

0 

0 

0 

0 

1 

1 

1 

0 

1 

1 

1 

1 

[0, 1] 

0 

[0, 1] 

0 

[0, 1] 

[0, 1] 

[0, 1] 

1 

1 

1 

[0, 1] 

1 

[0, 11 

[0, 1] 

[0, 11 

Figure  3  shows  the  fault  tree  for  a  generic  target  classification  subsystem.  In  this  example, 
critical  components  required  to  classify  a  target  include  one  C-band  or  wide-band  antenna,  a  receiver, 
a  signal  processor,  a  data  processor,  and  a  display  terminal.  The  CD  states  of  the  three  antennas, 
which  are  considered  redundant,  are  evaluated  and  then  linked  together  through  the  Boolean  OR 
operator.  This  implies  that  at  least  one  of  the  antennas  must  remain  functional  in  order  for  the 
subsystem  to  classify  a  target  (the  wide-band  antenna  is  assumed  to  cover  the  C-band  frequency 
range).  The  remaining  four  components  are  in  series,  therefore  implying  each  one  of  these 
components  must  function  in  order  for  the  subsystem  to  classify  a  target.  Thus,  these  CD  states  are 
linked  together  through  the  Boolean  AND  operator. 

2.1.2  RFI/Corruption  States.  Within  a  fault  tree,  CD  states  are  assigned  to  the  corresponding 
component  box.  However,  RFI  and  resource  corraption  (RC)  states  are  analyzed  a  bit  differently 
within  a  tree.  An  RFI  state  depends  on  the  effect  the  threat  has  on  the  individual  subsystems  flow 
of  a  resource  (such  as  electrical  current,  mechamcal  force,  digital  information,  or  the  task-d^endent 
action  of  a  soldier)  between  the  component  in  question  and  all  other  components  either  electrically, 
mechanically,  or  operationally  connected  to  the  first  In  this  case,  the  threat  usually  imposes  a  “back- 
and-forth”  change  in  state,  without  causing  any  physical  damage  to  the  component  An  example  is 
the  effect  a  smoke  or  obscurant  has  on  a  laser  beam  over  a  period  of  time.  When  the  smoke  or 
obscurant  is  dense,  the  laser  beam  is  not  able  to  penetrate,  but  as  the  smoke  or  obscurant  dissipates, 
the  laser  is  able  to  reach  its  intended  target  Note,  this  threat  effect  may  be  cyclic  over  a  given  time 
period  and  thus  produce  the  back-and-forth  change  of  state,  as  mentioned  earlier.  Again,  this  takes 
place  with  no  physical  damage  to  the  component  producing  the  laser  beam.  Thus,  a  RFI  state  is 
determined  by  evaluating  the  state  of  the  resource  flowing  in  or  out  of  the  component.  This 
evaluation  is  done  at  what  is  termed  a  node  within  the  tree.  The  example  fault  tree  in  Figure  3 
contains  five  node  points  labeled  A,  B,  C,  D,  and  E,  where  the  RFI  states  of  the  antenna  (whichever 
one  is  used),  the  receiver,  the  signal  processor,  the  data  processor,  and  the  display  terminal  are 
evaluated,  respectively.  If  any  of  these  critical  components  are  exposed  to  a  battlefield  threat  that 
interrupts  that  component’s  performance  (without  causing  any  permanent  damage  to  the  component), 
then,  within  a  fault  tree,  the  state  of  the  resource  flowing  out  of  the  component  into  a  node  point  is 
interrupted  in  a  corresponding  fashion.  In  order  to  evaluate  the  capability  metric  associated  with  a 
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FLOW  OF  INFORMATION 


* 


C-band  Wideband  C-band 

Antenna  #1  Antenna  Antenna  #2 


Figure  3.  Fault  Tree  for  a  Generic  Target  Classification  Subsystem. 
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fault  tree,  the  RH  states  within  the  tree  are  linked  together  using  the  Boolean  AND  operator.  TTiese 
RFI  states  are  measured  at  specified  nodes.  Fractional  values  of  a  component  resource  are  defined 
as  x/100.  Table  2  defines  the  mathematical  operation  of  the  Boolean  AND  operator  as  it  is  used  to 
connect  RFI  states.  Again,  as  seen  in  Table  1(a),  the  Boolean  AND  is  being  applied,  implying  that 
the  Boolean  outcome  of  component  no.  1  will  be  multiplied  to  the  Boolean  outcome  of  component 
no.  2  to  produce  the  net  component  state. 

Table  2.  Boolean  AND  Operation  Using  Binary  (0  and  1)  and  Fractional  (x/100)  RFI  States 


Value  of  Component 
No.  1 

Value  of  Component 
No.  2 

Net  Component  State  =  Component 
No.  1  AND  Component  No.  2 

0 

0 

0 

0 

1 

0 

1 

0 

0 

1 

1 

1 

x/100 

0 

0 

0 

x/100 

0 

x/100 

1 

x/100 

1 

x/100 

x/100 

x,/100 

Xj/lOO 

(Xi  X2)/10,000 

Next,  we  use  the  target  classification  fault  tree  in  Figure  3  to  illustrate  how  a  capability  metric 
is  affected  by  different  threat  environments.  Let  us  suppose  that  a  ballistic  threat  has  killed  “C-Band 
Antenna  No.  1.”  Then  we  can  calculate  the  capability  “Ability  to  Classify  a  Target”  as: 

Capability.., =  ([C-Band  Antenna  No.  1  =  0]  OR  [Wide-Band  Antenna  =  1]  OR  [C-Band 
Antenna  No.  2  =  1])  AND  (Receiver  =  1)  AND  (System  Processor  =  1)  AND  (Data 
Processor  =  1)  AND  (Display  Terminal  =  1)  =  1. 
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In  another  scenario,  suppose  a  chemical  agent  has  dissolved  materials  within  “Wide-Band 
Antenna”  and  “Display  Terminal,”  possibly  rendering  these  components  partially  operable  or 
inoperable,  so  that  the  net  CD  state  now  becomes 

Capabilitv.i„,i<y  =  ([C-Band  Antenna  No.  1  =  1]  OR  [Wide-Band  Antenna  =  [0, 1]]  OR  [C-Band 
Antenna  No.  2  =  1])  AND  (Receiver  =  1)  AND  (System  Processor  =  1)  AND  (Data 
Processor  =  1)  AND  (Display  Terminal  =  [0, 1])  =  [0, 1]. 

An  RC  state  relies  on  the  true  output  reading  of  an  algorithm  within  a  component  at  an  instant 
of  time.  Imagine  a  third  scenario  where  an  electronic  countermeasure  (ECM)  has  resulted  in  a  false 
target,  which  the  target  classification  subsystem  has  classified  as  a  real  target.  There  is  no 
component  damage  in  this  scenario;  there  is,  however,  considerable  RC  to  the  subsystem 
performance  due  to  the  presence  of  the  ECM.  Now,  because  the  ability  to  classify  a  target  is 
produced  by  an  aggregate  synergism  between  aU  critical  components  in  the  subsystem,  we  really  only 
need  to  evaluate  the  RC  state  (false  information  flowing  between  components)  at  node  E  (although 
the  subsystem  may  have  been  adversely  affected  at  any  one,  or  more,  of  the  components).  This  is 
the  point  where  target  classification  information  becomes  available  to  the  soldier.  Due  to  the  effect 
of  the  ECM, 


Capability^iassify  =  information  state  at  node  E  =  0. 

This  basically  tells  us  that  the  target  classification  system  is  unable  to  distinguish  a  false  target  from 
a  true  one.  For  more  information  regarding  the  aforementioned  states  see  Ruth  (1996). 

2.2  Fault  Trees.  Figures  4—1 1  show  the  eight  fault  trees  used  in  the  present  integrated  V/L 
analysis  of  the  Bradley  Linebacker.  Indicated  at  (he  top  of  each  figure  is  the  associated  system-level 
residual  capability  that  the  fault  tree  is  used  to  calculate.  The  “at”  (@)  symbol  next  to  a  box  within 
a  fault  tree  indicates  an  embedded  (child)  tree  widiin  the  box,  which  is  evaluated  before  the  (parent) 
tree.  The  output  from  an  embedded  tree  is  then  inserted  into  the  corresponding  box  within  the  parent 
tree.  Figures  12-14  show  the  embedded  “child”  fault  trees  associated  with  the  trees  shown  in 
Figures  4-11. 
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Figure  5.  OWl  -  Ability  to  Search  for  Target  Information. 
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STINGER  Distribution  Unit 


Gunner’s  Handstatinn 


Figure  9.  OSl  -  Ability  to  Engage  Target 
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Gunner’s  Handstatiom 
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F^re  10.  OS2  -  Ability  to  Rearm/Reload  Stinger  Missile. 
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Figure  11.  OS3  -  Ability  to  Hit  a  Target 
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Single  Channel  Ground/Airboi 
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me  Radio  System  (SINCGARS) 
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Simplified  Handheld  Terminal  Unit  (SHTU) 


Figure  12.  Embedded  “ChUd”  Tree  -  FAAD  C31  Kit 
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Figure  13.  Embedded  “Child”  Tree  -  Operation  Desert  Storm  Kit. 


Figure  14.  Embedded  ^^Child”  Tree  -  Stinger  Missile  System. 


The  following  explanation  is  provided  on  the  “crew”  portion  embedded  within  the  parent  fault 
trees  for  all  of  the  Bradley  Linebacker  capabilities  analyzed  within  this  report.  The  methodology 
employed  within  this  portion  of  the  tree  uses  a  mixture  of  CD  and  RFI  states  in  order  to  calculate  the 
soldier  performance  resource  (where  the  resource  is  a  time-dependent  set  of  actions  required  for  a 
task).  For  example.  Figure  15  illustrates  a  portion  of  a  fault  tree  containing  the  crew.  After 
determining  which  skills  were  necessary  for  each  capability,  a  priority  was  established  among  the 
crew  members  (Papke  1996).  Once  this  was  established,  a  correction  factor  (CF)  was  determined 
for  each  crew  member.  A  CF  is  a  number  stating  how  long  it  takes  a  member  of  the  crew  to 
complete  a  task  or  skill  while  wearing  MOPP IV  gear.  Then  from  this  data,  an  overall  correction 
factor  (OCF)  is  achieved  by  the  summation  of  the  product  of  CFs  and  a  weighted  value  (WT)  (i.e., 
[OCF  =  (CFi*WTi)  +  (CF2*WT2)  +  ...  +  (CF^*WTJ,  where  m  =  the  number  of  skills  used  in  a 
category])  (Kelley  1995).  A  weighted  value  is  a  number  to  determine  what  percentage  of  total  time 
a  crew  member  spends  perform  that  skill.  This  OCF  was  then  incorporated  into  a  degradation  value 
(DV)  for  each  crew  member.  A  DV  is  a  number  that  indicates  the  effectiveness  of  a  crew  member 
while  wearing  MOPP  IV.  For  instance,  a  DV  of  0.66  means  the  soldier  is  66%  effective  in 
MOPP  rv,  and,  since  the  DV  is  the  reciprocal  the  OCF,  which  equals  1.52,  the  soldier’s  tasks  should 
taVf.  approximately  52%  longer  to  complete  in  MOPP  IV  as  compared  to  MOPP  0  conditions,  since 

1  Time  required  to  do  a  task  in  MOPP  0 

I  y  V  —  — —  —  ■■  . .  • 

OCF  Time  required  to  do  a  task  in  MOPP  IV 

Though  the  crew  is  cross-trained,  the  commander  is  given  first  priority  in  the  example,  therefore 
evaluated  first,  and  if  he/she  is  somehow  incapacitated,  then  the  gurmer  is  the  crew  member  that  has 
the  responsibility  to  enable  the  respective  capability.  If  the  commander  is  alive  and  able  to  perform 
this  task,  then  the  next  step  in  determining  his/her  task  worth  is  by  using  the  DV. 

This  final  value  then  represents  the  crew  member  RFI  state  within  a  specific  fault  tree.  In  a 
scenario  where  the  only  source  of  component  interruption  is  MOPP  IV  compatibility,  the  crew 
member  RFI  state  is  directly  mapped  into  the  residual  capability  state  of  which  the  crew  member  is 
a  component.  For  a  detailed  explanation  of  DVs,  see  Kelley  (1997). 
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Figure  15.  Portion  of  “Parent”  Tree  Containing  the  Crew. 
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3.  Conclusions 


This  integrated  fault  tree  methodology  proved  to  be  successful  in  the  system  analysis  of  the 
Bradley  linebacker  in  that  it  was  used  to  assess  the  vulnerability  throughout  the  whole  threat 
spectrum.  This  fault  tree  methodology  is  also  the  first  ever  produced,  where  the  effects  of  synergistic 
battlefield  threats  were  implemented  in  order  to  produce  battlefield  capabilities.  Since  Boolean  was 
designed  for  calculation  with  binary  metrics  (0  and  1),  we  need  to  specify  the  limitation  in  using 
Boolean  logical  operators  to  combine  fractional  metrics  between  0  and  1  when  evaluating  RFI  due 
to  MOPP IV.  This  limitation  entails  the  necessary  assumption  that  the  subsystem  represented  by  a 
fault  tree  mathematically  behaves  as  a  linear  system.  This  simply  means  that  the  aggregated  net 
component  state  of  a  set  of  componaits  logically  linked  together  in  series  is  equal  to  the  product  of 
each  independent  component  state. 
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Appendix: 

Boolean  Operations  on  Lukasiewicz  Three-Valued  Logic 
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Intentionally  left  blank. 
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Since  the  conventional  fault  tree  methodology  used  in  a  vulnerability/lethality  (V/L)  analysis 
utilizes  Boolean  operations  on  binary  (two- valued)  logic,  the  conventional  methodology  needed  to 
be  extended  to  accommodate  the  aforementioned  approximate  states.  Thus,  within  the  context  of 
nonmeasurable  level-2  metrics,  the  extended  methodology  was  required  to  address  three  different 
allowed  values  of  component  functionality:  1  (fully  functional),  0  (fully  nonfunctional),  and 
APPROX  (for  an  approximate  damage  state  reflecting  some  unquantifiable  amount  of  component 
damage  that  may  or  may  not  result  in  loss  of  component  function).  In  these  instances,  an  undamaged 
component  is  assumed  to  be  folly  functional  (a  state  of  1),  while  a  damaged  component  can  only  be 
represented  by  an  approximate  state  (a  state  of  APPROX);  in  the  case  where  a  catastrophic 
component  kill  is  likely  due  to  level- 1  threat  initial  conditions,  the  analyst  might  choose  to  estimate 
the  component  state  as  folly  nonfunctional  (a  state  of  0). 

Boolean  operations  on  1, 0,  and  APPROX  follow  the  rules  of  a  three-valued  logic  as  originally 
proposed  by  Lukasiewicz  in  1920.*  Tables  A-1,  A-2,  and  A-3  illustrate  the  trath  tables  produced  by 
applying  the  logical  AND,  OR,  and  NOT  (negation)  operators,  respectively,  on  this  three-valued 
logic.  As  is  seen  from  these  tables,  removal  of  the  APPROX  state  collapses  the  Lukasiewicz  logic 
to  the  standard  binary  logic. 

Table  A-1.  Boolean  Operations  on  the  Lukasiewicz  Three-Valued  Logic:  the  AND  Operation 


1  AND 

0 

APPROX 

1 

1  ^ 

0 

0 

0 

1  APPROX 

0 

APPROX 

APPROX 

1  1 

0 

APPROX 

1 

*  Borkowski,  L.,  and  J.  Slupecki.  “The  Logical  Works  of  Jan  Lukasiewicz.”  Studia  Logica,  vol.  8,  pp.  7-56, 1958. 


29 


Table  A-2.  Boolean  Operations  on  the  Lukasiewicz  Three- Valued  Logic:  the  OR  Operation 


OR 

0 

APPROX 

1  1 

0 

APPROX 

1 

APPROX 

APPROX 

APPROX 

1 

1 

1 

1 

1 

Table  A-3.  Boolean  Operations  on  the  Lukasiewicz  Three-Valued  Logic:  the  NOT  Operation 


NOT  1 

0 

1  1 

APPROX 

APPROX  \ 

1 

0  \ 
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